Withdrawing Explicit Consent under KVKK: Right, Process and Duties

Explicit consent is one of the legal bases for processing personal data under KVKK; but just as it is given, it can also be withdrawn. We previously covered what explicit consent is and how to obtain it. This article focuses on the other side of the coin: withdrawing explicit consent.

This content is for general information only and does not constitute legal advice.

Can explicit consent be withdrawn?

Yes. Explicit consent is an approval declared with free will, and the data subject can withdraw it at any time. Withdrawal takes effect going forward: it does not invalidate lawful processing done up to that point, but it stops consent-based processing for the period after withdrawal.

How should withdrawal work?

The general principle is: withdrawing consent must be as easy as giving it. Therefore:

• The withdrawal channel must be clear and accessible (e.g. email, account settings, cookie panel, an "unsubscribe" link).
• Withdrawal must be free and free of unnecessary obstacles.
• The request must be processed within a reasonable time and the outcome communicated.

What happens to processing after withdrawal?

The critical question here is: was that processing based solely on explicit consent?

• If consent was the only basis: Processing stops upon withdrawal; the data is deleted, destroyed or anonymized unless another retention obligation applies.
• If there is another legal basis: Processing may continue on that basis; even then, transparency and an explanation to the data subject are required.

The data controller's duties

• Facilitate: Make withdrawal easy and visible.
• Record and prove: Record the withdrawal request, its date and outcome.
• Propagate: If data was transferred to other parties, convey the withdrawal to them as far as possible.
• Destroy: Where consent was the only basis, move the relevant data into the disposal process.

Common mistakes

• Making withdrawal hard: Giving consent is one click, withdrawing takes a long process — this undermines the freedom of consent.
• Not recording withdrawal: Unprovable withdrawal is a weakness in an audit.
• Not stopping processing: Continuing to process when consent was the only basis is unlawful.

Managing the process

Managing the giving, versioning and withdrawal of explicit consent in a provable way is hard to do manually. Kivuz KVKK is a KVKK compliance software that records consent and notice processes; for withdrawing cookie consent on your website, see our cookie consent management product. To manage withdrawal requests and other data-subject applications end to end, you can use our Request Process Management service. To see the whole, request a demo.